Reverse Engineering Skills in reverse-skill: APK, IDA Pro, Ghidra, and 12 Specialized Workflows

The reverse-skill repository bundles 12 distinct reverse engineering capabilities—from Android APK analysis and IDA Pro automation to firmware penetration testing and hardware security testing—into modular, script-driven workflows under the skills/ directory.

The reverse-skill open-source project by zhaoxuya520 organizes complex reverse engineering tasks into discrete, reusable modules. Each skill encapsulates a specific reverse engineering workflow, complete with deterministic scripts, tool-index integration, and step-by-step documentation in individual SKILL.md files.

Core Reverse Engineering Skills Supported

The repository structures each capability as a standalone directory under skills/, containing PowerShell or Bash scripts, dependency checklists, and evidence-gathering templates.

Mobile and Application Analysis

• apk-reverse: Targets Android application packages for static analysis, smali patching, recompilation, and Frida-based dynamic hooking. Integrates jadx, apktool, frida, and adb, with optional fallback to ida-reverse or radare2 for native .so binaries. See skills/apk-reverse/SKILL.md for the complete workflow checklist.

• mobile-reverse: Generalized mobile binary analysis for iOS Mach-O and Android native libraries. Acts as a meta-skill delegating to underlying IDA Pro, Ghidra, or Radare2 engines based on binary type and user hints.

• macos-reverse: macOS-specific Mach-O reverse engineering with code-signing validation and notch-aware analysis pipelines. Maps to ida-reverse, ghidra-reverse, and radare2 toolchains.

• js-reverse: JavaScript and TypeScript static analysis, including Webpack unpacking and obfuscation removal. Utilizes node, js-hook-mcp, and deobfuscator-tool for Chrome DevTools Protocol (CDP) and Frida hooking.

• dotnet-reverse: .NET and Mono assembly decompilation with IL inspection and protection bypass capabilities. Primary tooling includes dnSpy and dotnet-decompiler, with optional IDA Pro integration for mixed-mode assemblies.

Binary Analysis and Disassembly Engines

• ida-reverse: Full-featured IDA Pro automation supporting PE, ELF, Mach-O, APK, DLL, and SO formats. Implements MCP (Model Context Protocol) server integration via idalib-mcp, controlled through helper scripts start.ps1 and open.ps1 located in skills/ida-reverse/scripts/.

• ghidra-reverse: Open-source alternative to IDA Pro emphasizing headless (batch) decompilation and script-driven analysis. Supports optional ghidra-mcp bridge and ghidriff for binary comparison. Configuration resides in skills/ghidra-reverse/SKILL.md.

• radare2: Lightweight CLI-only analysis for rapid triage when GUI tools are unavailable. Leverages r2 and r2pipe for fast function listing and string extraction without overhead.

Specialized Runtime and Firmware

• go-rust-reverse: Addresses stripped Go and Rust binaries through symbol recovery, name demangling, and de-obfuscation. Uses go-decompiler, rust-demangle, and ghidriff for differential analysis of compiled artifacts.

• firmware-pentest: End-to-end firmware extraction, emulation, and fuzzing pipelines. Integrates binwalk for extraction, qemu for emulation, and angr for symbolic execution, documented in skills/firmware-pentest/SKILL.md.

• hardware-security: Hardware debugging interface triage including JTAG and SWD protocols. Implements openocd and pyOCD for firmware dumping from embedded devices, with guidance in skills/hardware-security/SKILL.md.

Differential Analysis

• binary-diff (via patch-diff-exploit): Differential analysis between binary versions to locate security patches, generate exploits, and scaffold patch-based attacks. Primary tooling includes ghidriff and custom binary-diff utilities.

Architecture and Routing System

The repository employs a centralized routing layer to dispatch user requests to the appropriate skill module. The routing core defined in routing.md and routing-benchmark.json parses user hints (e.g., "apk reverse", "ida", "firmware") and maps them to specific SKILL.md files.

The tool-index system—implemented via skills/scripts/refresh-tool-index.sh and refresh-tool-index.ps1—auto-detects locally installed binaries and populates path mappings in $HOME/tools/. This enables automatic bootstrapping when a required tool is missing, handled by skills/scripts/bootstrap-reverse.* scripts.

Each skill enforces evidence-gathering through "Task Completion Self-Check" checklists, ensuring analysis artifacts (extracted strings, function signatures, reports) are recorded before workflow completion.

Hands-On Examples for Each Skill

Below are minimal, runnable commands extracted from the repository’s script library. All paths are relative to the repository root.

Android APK Static Analysis

Decompile Java sources and extract smali, then generate a manifest summary:

# Decode APK and extract resources

pwsh -File "skills/apk-reverse/scripts/decode.ps1" -ApkPath "D:\Downloads\sample.apk" -Clean

# Analyze AndroidManifest.xml for permissions and entry points

pwsh -File "skills/apk-reverse/scripts/manifest-summary.ps1" -ManifestPath "apktool_out\AndroidManifest.xml"

IDA Pro MCP Server Automation

Start the MCP HTTP server and open a target binary with progress monitoring:

# Spin up the MCP server (background process)

pwsh -File "skills/ida-reverse/scripts/start.ps1"

# Open malware sample with 600-second timeout and System32 auto-copy

pwsh -File "skills/ida-reverse/scripts/open.ps1" -Path "C:\Samples\malware.exe" -TimeoutSeconds 600

Headless Ghidra Batch Processing

Run unattended analysis on a directory of binaries using Ghidra’s headless analyzer:

# Import and analyze with post-script export

analyzeHeadless /home/user/ghidra_projects SampleProj \
  -import /data/binaries/sample.bin \
  -postScript ExportDecomp.py

Rapid Radare2 Triage

Perform function listing and string analysis in a single command:

# Open binary, analyze functions (afl), grep strings for 'http', then quit

r2 -A sample.bin -c "afl; iz~'http'; q"

Go and Rust Symbol Recovery

Execute symbol extraction against stripped binaries:

# Recover function names from Go/Rust compiled executables

pwsh -File "skills/go-rust-reverse/scripts/extract-symbols.ps1" -BinPath "bin/myapp"

Key Configuration Files and Directory Structure

Component	File Path	Purpose
Skill Definition	skills/<skill>/SKILL.md	Workflow scope, tool requirements, and step-by-step guides for each reverse engineering discipline.
Routing Config	skills/config/routing.json	Maps hint strings to specific skill directories and execution contexts.
Tool Index	skills/scripts/refresh-tool-index.ps1 / .sh	Auto-detects installed tools (jadx, apktool, Ghidra, etc.) and generates path mappings.
Bootstrap Scripts	skills/scripts/bootstrap-reverse.*	Handles automated installation of missing dependencies.
Skill Scripts	skills/<skill>/scripts/*.ps1	Executable workflows (e.g., decode.ps1, start.ps1, extract-symbols.ps1).
Evidence Templates	skills/*/references/*.md	Checklists ensuring consistent artifact documentation across analyses.

Summary

• The reverse-skill repository provides 12 specialized reverse engineering skills covering mobile, desktop, firmware, and hardware targets.
• Each skill is encapsulated under skills/<skill-name>/ with a dedicated SKILL.md, executable scripts, and evidence templates.
• The routing system (routing.md, routing-benchmark.json) automatically dispatches tasks based on user hints.
• Tool-index automation (refresh-tool-index.*) handles path resolution and bootstrapping for tools like IDA Pro, Ghidra, and Frida.
• Scripts support both interactive GUI workflows (IDA Pro, Ghidra GUI) and headless automation (Ghidra headless, Radare2, batch processing).

Frequently Asked Questions

What specific reverse engineering tools does reverse-skill automatically configure?

The repository automatically detects and configures paths for IDA Pro, Ghidra, Radare2, JADX, Apktool, Frida, ADB, dnSpy, Binwalk, QEMU, OpenOCD, and Ghidriff through the refresh-tool-index scripts. If a tool is missing, the bootstrap scripts in skills/scripts/ attempt automated installation or prompt for manual path configuration.

How does the routing system determine which skill to execute?

The routing core consults routing.json and routing-benchmark.json to match user-provided hints (e.g., "apk reverse", "ida", "firmware pentest") against registered skill signatures. Once matched, it loads the corresponding SKILL.md and executes the entry-point scripts defined in that skill's scripts/ directory.

Can reverse-skill operate in fully headless environments without GUI access?

Yes. The ghidra-reverse and radare2 skills are designed specifically for headless operation. Ghidra utilizes analyzeHeadless for batch processing, while Radare2 provides pure CLI analysis. Even the ida-reverse skill supports MCP-based automation that can run IDA Pro in automated modes without manual GUI interaction.

Which skill should I use for analyzing stripped Go or Rust binaries?

Use the go-rust-reverse skill located at skills/go-rust-reverse/. It specializes in recovering function symbols from stripped Go binaries using go-decompiler and demangling Rust symbols with rust-demangle, outputting recovered names for import into Ghidra or IDA Pro.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}